Capita fined £14m over 2023 cyber attack that exposed millions of people’s personal data

Capita could be forced to compensate the 6.6 million people, including pension holders, who had their personal data breached

Outsourcing giant Capita has been fined £14 million for a major data breach that exposed the personal details of more than 6.6 million people, including pension holders, employees, and customers of organisations the company serves. The Information Commissioner’s Office (ICO) said the 2023 cyber attack could have been prevented if Capita had maintained “sufficient security measures.”

John Edwards, UK Information Commissioner, said: “Capita failed in its duty to protect the data entrusted to it by millions of people. The scale of this breach and its impact could have been prevented had sufficient security measures been in place. When a company of Capita’s size falls short, the consequences can be significant – not only for those whose data is compromised, but for wider trust amongst the public.”

Capita’s fine falls short of compensating people who were affected by this data breach.

Alex Neill, co-founder of Consumer Voice, said: “People will feel badly let down that a major institution like Capita failed to protect their personal data, especially when this breach could have been prevented. While the regulator’s fine sends a message, it does nothing to compensate those whose lives have been disrupted.”

Under UK data protection laws, you have the right to claim compensation if a company has mishandled your personal data and you’ve suffered harm, such as financial loss or emotional distress. If the company won’t agree to pay you compensation when you complain you will have to go to court. 

We are working with KP Law to find people who might be affected by the data breach to help them hold Capita to account and get back the compensation they’re owed.  You could be eligible to join KP Law’s claim against Capita if you got an email or letter from a pension provider confirming you are affected. 

Kingsley Hayes, partner and head of data and privacy litigation at KP Law, said:

“The ICO’s report lays out Capita’s absolute disregard of its responsibility to keep highly sensitive customer data safe. While the ICO fine goes some way to ensure Capita is held to account, many thousands of those affected are still left with the worry and distress caused by Capita’s actions.”

How the Capita data breach happened

The attack began in March 2023 when a malicious file was mistakenly downloaded onto a Capita employee’s device. Although an internal alert was triggered within 10 minutes, it took 58 hours for the company to properly isolate the compromised system – nearly 60 times longer than the ICO’s one-hour target response.

This delay gave hackers time to infiltrate Capita’s network, gain administrator access, and steal almost a terabyte of personal data before deploying ransomware that locked staff out of company systems. The stolen information included pension records, employee details, and customer data and, in some cases, extending to sensitive details such as criminal records, financial data, and information about race or religion.

Capita was fined £8 million and its pension administration arm, Capita Pension Solutions, a further £6 million. The regulator initially proposed a £45 million penalty but agreed to reduce it following Capita’s cooperation, improvements to its cyber defences, and steps taken to contact those affected.

Capita “regrets” cybersecurity vulnerabilities

Capita said it “regrets the incident” and has since made major changes to its cybersecurity systems. Chief executive Adolfo Hernandez, who joined in 2024, said he had accelerated the company’s “cyber security transformation” and “embedded a culture of continuous vigilance.”

However, the ICO’s investigation found the company had ignored repeated warnings about vulnerabilities before the attack. It said Capita’s internal security team was understaffed, its monitoring inadequate, and its systems had not been properly tested since they were first commissioned.

Have you been impacted by the Capita data breach?

If you received a letter or email from your pension provider confirming that you were affected by the Capita data breach, you could be eligible to join a group legal claim.

Consumer Voice is working with KP Law, a specialist group action law firm, to help affected pension holders and their beneficiaries seek compensation. KP Law represents clients across more than 35 pension schemes and is acting on a no-win-no-fee basis.

You may be eligible to join if:

• You have been contacted by your pension provider or Capita confirming you were affected by the breach
• Your personal or financial information may have been exposed as part of the 2023 Capita cyber attack

Protect yourself after a data breach

This news follows a number of high profile cyber attacks, with Jaguar Land Rover still recovering from a damaging hack just months after Marks & Spencer was badly hit. If your data was compromised, it’s important to stay vigilant:

• Monitor your bank accounts and credit reports for unusual activity
• Watch out for phishing emails pretending to be from pension or financial providers
• Change passwords on any online accounts linked to your email address
• Consider signing up for credit monitoring services if you haven’t already

You can also read Consumer Voice’s guide to protecting yourself after a data breach, which explains when you might be entitled to compensation and how to stay safe from fraud and identity theft.